Privacy Policy

Last updated: 13 October, 2026

1. Who We Are

Culture Craft is a delivery-first people and culture agency for scaling businesses, operating in the United Kingdom.

For the purposes of UK data protection law, Culture Craft is the data controller of the personal data described in this policy.

Registered office: Bartle House, 9 Oxford Court, Manchester, M2 3WQ

Contact: info@culturecraft.team

2. What This Policy Covers

This policy explains how Culture Craft collects and uses personal data when you:

visit and use our website at www.culturecraft.team
contact us by email, contact form, or phone
subscribe to our newsletter or marketing updates
enter a competition or prize draw run by Culture Craft
complete the Growth Readiness Review or any other diagnostic tool we offer
engage with us as a prospective or current client

This policy does not cover how we handle personal data in our capacity as a data processor on behalf of client organisations. That processing is governed by the relevant client data processing agreement.

3. Personal Data We Collect

3.1 Data you provide to us directly

When you contact us, complete a form, enter a competition, or use any of our tools or services, we may collect:

your name, job title, and company name
your email address and phone number
your business address or location
your responses to diagnostic questions or assessments (such as the Growth Readiness Review)
competition entry responses (such as answers to entry questions)
any other information you choose to provide when communicating with us

3.2 Data we collect automatically

When you visit our website, we collect certain technical data automatically via cookies and similar technologies, including:

your IP address and approximate location
browser type, device type, and operating system
pages visited, time spent on pages, and navigation patterns
referring website or source

For full details of how we use cookies, please see our Cookie Policy at www.culturecraft.team/cookie-policy.

3.3 Data we collect from third-party sources

In the course of business development, we may obtain contact information (such as name, job title, company, and professional email address) from third-party sources including:

publicly available professional databases and directories
LinkedIn and other professional networking platforms
prospecting and data enrichment tools (currently Apollo.io) where data is sourced from publicly available professional information
event organisers who provide attendee lists where permitted by the terms of the relevant event

Where we obtain data from third parties for outreach purposes, we rely on the legitimate interests lawful basis (see section 4 below) and will always provide you with clear information about how we use your data and how to opt out when we first contact you.

4. Lawful Basis for Processing

UK GDPR requires us to have a lawful basis for each type of processing we carry out. The bases we rely on are:

4.1 Legitimate interests

We process personal data on the basis of legitimate interests where we have a genuine business reason to do so and that reason is not overridden by your rights and interests. This includes:

contacting prospective clients by email or LinkedIn where they work in a role likely to benefit from our services
following up on enquiries or event interactions where you have engaged with Culture Craft
improving and developing our website and services
maintaining records of business communications

When we rely on legitimate interests, you have the right to object to that processing at any time (see section 7).

4.2 Consent

We rely on consent where you have actively opted in to a specific use of your data. This includes:

subscribing to our newsletter or marketing communications
opting in to marketing emails when entering a competition
accepting non-essential cookies on our website

Consent is always optional and can be withdrawn at any time without affecting any other relationship you have with us.

4.3 Contract

We process personal data where it is necessary to perform a contract with you or to take steps at your request before entering into a contract. This includes processing contact and business details to deliver our services to clients.

4.4 Legal obligation

We may process personal data where required to comply with a legal obligation, such as retaining records for tax or accounting purposes.

5. How We Use Your Personal Data

We use personal data for the following purposes:

to respond to enquiries and provide information about our services
to deliver services to clients, including diagnostic assessments and consulting engagements
to administer competitions and prize draws and to notify and fulfil prizes for winners
to send marketing communications, newsletters, and event information to those who have opted in or who we are contacting on the basis of legitimate interests
to operate and improve our website
to maintain our business records and comply with legal and regulatory obligations
to conduct outbound business development outreach to prospective clients

We do not use personal data to make automated decisions that have a legal or similarly significant effect on individuals.

6. Marketing and Outreach

We send marketing emails and outreach communications using HubSpot as our email platform. Every marketing email we send includes a clear and functional unsubscribe link. You can opt out at any time by:

clicking the unsubscribe link in any email we send
emailing us at info@culturecraft.team

Where we contact you on the basis of legitimate interests (for example, as part of a prospecting campaign), we will tell you clearly who we are, why we are contacting you, and how to opt out. Once you opt out, we will not contact you again for marketing purposes.

We do not share your personal data with third parties for their own marketing purposes.

7. Your Rights Under UK GDPR

You have the following rights in relation to your personal data. You can exercise any of these rights by contacting us at info@culturecraft.team.

Right of access — you can ask us to confirm whether we hold personal data about you and to provide you with a copy of it.
Right to rectification — you can ask us to correct inaccurate or incomplete personal data we hold about you.
Right to erasure — you can ask us to delete your personal data in certain circumstances, including where it is no longer necessary for the purpose for which it was collected.
Right to restriction of processing — you can ask us to pause processing of your data in certain circumstances, for example while you contest its accuracy.
Right to data portability — where processing is based on consent or contract and carried out by automated means, you can ask us to provide your data in a structured, commonly used, machine-readable format.
Right to object — you can object to processing based on legitimate interests at any time. We will stop processing unless we can demonstrate compelling legitimate grounds that override your rights.
Right to withdraw consent — where processing is based on consent, you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

We will respond to rights requests within one calendar month of receipt. We will not charge a fee for reasonable requests. If a request is manifestly unfounded or excessive, we reserve the right to charge a reasonable fee or to decline to respond, giving our reasons.

If you are not satisfied with how we have handled your personal data, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at www.ico.org.uk or by calling 0303 123 1113.

8. Who We Share Data With

We do not sell personal data. We share personal data only in the following limited circumstances:

8.1 Service providers (data processors)

We engage carefully selected third-party partners and service providers who process personal data on our behalf in compliance with GDPR. These currently include:

HubSpot — CRM and email marketing platform (data stored in the EU/US under standard contractual clauses)
Apollo.io — prospecting and outreach data tool (used to identify and contact prospective clients)
Vercel — website hosting and content delivery network (data processed in the EU/US under standard contractual clauses)
Google Analytics — website traffic analysis (only where you have consented to analytics cookies)

From time to time, we appoint digital marketing agencies to conduct outreach and marketing activities on our behalf. As part of these activities, personal data may be processed in accordance with applicable data protection laws.

Our appointed data processors include:

(i) Prospect Global Ltd (trading as Sopro) Reg. UK Co. 09648733. You can contact Sopro and view their privacy policy here: http://sopro.io. Sopro is registered with the ICO Reg: ZA346877. Their Data Protection Officer can be emailed at: dpo@sopro.io

All service providers are required by contract to handle personal data securely and in accordance with our instructions. They are not permitted to use your data for their own purposes.

8.2 Legal requirements

We may disclose personal data to law enforcement, regulatory bodies, or courts where required to do so by law or to protect the rights, property, or safety of Culture Craft, our clients, or others.

8.3 Business transfers

In the event that Culture Craft is acquired, merged, or its business is otherwise transferred, personal data may be transferred as part of that transaction. We will notify affected individuals in advance where required by law.

9. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by law. Our general retention periods are:

contact and enquiry data: 2 years from last contact, or longer if an active client relationship develops
client engagement records: 6 years from the end of the engagement (in line with limitation periods under English law)
competition entry data: 12 months from the closing date of the competition
marketing opt-in records: retained for the duration of the marketing relationship and for a reasonable period thereafter as evidence of consent
outreach contact data (legitimate interests): until you opt out, after which we retain a record of your opt-out to ensure we do not contact you again
financial and accounting records: 6 years as required by HMRC

When personal data is no longer required, we delete or anonymise it securely.

10. How We Keep Your Data Secure

We take data security seriously and implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These include:

access controls limiting who within our team can access personal data
secure password management and multi-factor authentication on key systems
use of reputable, security-audited third-party platforms for data storage and communications
regular review of our data handling practices

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and will notify affected individuals without undue delay where required to do so.

11. International Data Transfers

Some of our service providers may store or process personal data outside the United Kingdom. Where this occurs, we ensure that appropriate safeguards are in place in accordance with UK GDPR, including:

transfers to countries with UK adequacy regulations in place
use of UK International Data Transfer Agreements (IDTAs) or EU Standard Contractual Clauses where appropriate

You can request further information about the safeguards we have in place for international transfers by contacting us at info@culturecraft.team.

12. Cookies

Our website uses cookies and similar technologies. We only set non-essential cookies (such as analytics cookies) where you have given your consent via our cookie consent banner. For full details of the cookies we use and how to manage them, please see our Cookie Policy at www.culturecraft.team/cookie-policy.

13. Changes to This Policy

We review and update this policy periodically to reflect changes in our practices, services, or legal requirements. The date at the top of this page shows when it was last updated. Where changes are material, we will take reasonable steps to bring them to your attention, such as by posting a notice on our website.

14. Contact Us

If you have any questions about this policy or wish to exercise your data protection rights, please contact us:

Culture Craft
Bartle House, 9 Oxford Court
Manchester, M2 3WQ

Email: info@culturecraft.team

We aim to respond to all data protection queries within five business days.